A company runs a three-tier application in a public cloud VPC. The web tier must accept HTTPS traffic from the internet, the app tier must accept traffic only from the web tier, and the database tier must accept traffic only from the app tier on port 3306. The security team wants to enforce least-privilege access using cloud-native constructs. Which configuration should be implemented?

Create a network ACL for each tier that allows only the required source IP addresses and ports, and attach them to each subnet.

Create a security group for each tier and configure inbound rules that reference the security group ID of the allowed source tier, with no broad allow rules.

Create a network ACL that allows all traffic within the VPC and a security group for each tier that references the previous tier's security group ID in its inbound rules.

Create a single security group for all tiers and use network ACL rules to restrict traffic between tiers by IP address ranges.

Which method is commonly used to monitor the effectiveness of micro-segmentation policies?

Relying solely on the cloud provider's default reports

Disabling all logging to improve performance

Using only manual audits without any automated tools

Reviewing firewall logs for denied and allowed traffic

What is the first step in implementing micro-segmentation in a cloud architecture?

Identify and map all workloads and their communication flows

Enable logging on all workloads

Create security policies for all workloads

A company is planning to implement micro-segmentation across its cloud environment. The security team wants to minimize the risk of breaking existing applications while rolling out policies. Which implementation strategy should they use?

Deploy the same security group to all workloads and then gradually remove it after a week.

Use a third-party tool to automatically generate and enforce policies without any manual review.

Immediately enforce a default-deny policy across all workloads and then add allow rules as issues are reported.

Start with a monitoring-only mode to learn traffic flows, then create policies based on observed flows and enforce them gradually.

A security architect is comparing distributed firewall solutions for a cloud environment that also includes bare-metal servers. The solution must enforce consistent policies across both virtualized and bare-metal workloads. Which capability is essential?

A host-based agent that can enforce policies on both VMs and bare-metal servers.

A hypervisor-level firewall that also supports bare-metal via network taps.

Integration with the cloud provider's native security groups.

A centralized management console that can push policies to both environments.

GIAC Cloud Security Architecture and Design

Domain 2Objective 2

Cloud Network Micro Segmentation GCAD Practice Questions (Page 3)

Part of the Network Architecture and Security domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 11–15

11application · medium
A company runs a three-tier application in a public cloud VPC. The web tier must accept HTTPS traffic from the internet, the app tier must accept traffic only from the web tier, and the database tier must accept traffic only from the app tier on port 3306. The security team wants to enforce least-privilege access using cloud-native constructs. Which configuration should be implemented?
Select an answer first
12foundation · easy
Which method is commonly used to monitor the effectiveness of micro-segmentation policies?
Select an answer first
13foundation · easy
What is the first step in implementing micro-segmentation in a cloud architecture?
Select an answer first
14application · medium
A company is planning to implement micro-segmentation across its cloud environment. The security team wants to minimize the risk of breaking existing applications while rolling out policies. Which implementation strategy should they use?
Select an answer first
15expert · hard
A security architect is comparing distributed firewall solutions for a cloud environment that also includes bare-metal servers. The solution must enforce consistent policies across both virtualized and bare-metal workloads. Which capability is essential?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.